GO-2025-3528 | Vulnetix

GO-2025-3528 PUBLISHED CVSS 9.300000190734863 CRITICAL

Record from OSV · Published March 18, 2025

containerd has an integer overflow in User ID handling in github.com/containerd/containerd

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
github.com/containerd/containerd	Go Modules	1.7.27, 1.6.38
github.com/containerd/containerd/v2	Go Modules	2.0.4
consul-k8s-fips-1.4	Chainguard	1.4.8-r10
k8ssandra-client	Chainguard	0.6.1-r1
helm-operator-fips	Chainguard	1.39.1-r6
k8sgpt	Wolfi	0.4.1-r1
cert-manager-cmctl	Chainguard	2.1.1-r9
helm-fips	Chainguard	3.17.2-r1
k3s	Chainguard	1.34.1.1-r2
consul-k8s-1.6	Chainguard	1.6.2-r9
cilium-cli	Chainguard	0.18.2-r2
docker	Chainguard	28.0.2-r0

88 more packages have a fixed version. See every fix in Lookup.

CVSS 4.0

9.300000190734863

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

…and 119 more

The same record, from the CLI:

vulnetix vdb vuln GO-2025-3528
vulnetix vdb fixes GO-2025-3528

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GO-2025-3528/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart